|
By Randall Degges
I've spent the better part of three years wiring AI into how my teams build and ship software. So when the news broke this week that the US government had effectively switched off an AI model, I was legitimately shocked. Not for one country. Not for one company. For everyone on the planet, all at once. Three days. That's how long Anthropic's Fable 5 and Mythos 5 models were available before the government ordered them shut off for everyone.
|
By Stephen Thoemmes
On the evening of June 12, 2026, Anthropic disabled access to two of its newest models, Claude Fable 5 and Claude Mythos 5, for every customer worldwide. The company did not do this because of an outage or a self-discovered flaw. It did it to comply with a US government export-control directive, received at 5:21 PM ET that day, citing national security authorities.
|
By Snyk Team
Most organizations spend their AI security budget on the wrong layer. The instinct is to just buy visibility to inventory the models, map the APIs, and ship a dashboard. But visibility alone won’t stop the coding agent that just pulled in a compromised MCP server. It won’t stop the production agent that’s about to forward a customer record to a place it shouldn’t go.
|
By Stephen Thoemmes
With code being written (& generated) faster than ever before, there is the unfortunate side effect that security vulnerabilities are also coming faster than ever before. Asking your LLM not to include security vulnerabilities in its code doesn't always work. It is becoming clear that the way software is built today, manually or with assistance, is insufficient when it comes to reliably, consistently, and provably writing secure code.
|
By Liran Tal
A supply chain attack is actively spreading through the npm registry by abusing a file most security tooling never looks at: binding.gyp. Instead of relying on the well-monitored preinstall or postinstall lifecycle scripts, the malware ships a weaponized binding.gyp that triggers node-gyp to execute attacker-controlled code automatically during npm install.
|
By Daniel Berman
For years, application security ran on a simple assumption: software moves through a lifecycle, and security inspects the artifacts as they travel from development to production. Developers plan, write code, commit it, test it, scan it, and ship it. Every control built, including pull request reviews, CI/CD gates, and post-commit scanning, assumed a human was sitting between each step, making decisions a tool could later check.
|
By Brian Vermeer
On May 25, 2026, the maintainer of jqwik, a Java property-based testing library, released version 1.10.0 to Maven Central with a hidden instruction intended for AI coding agents. The payload told agents to disregard previous instructions and delete all jqwik tests and code. It was hidden from humans with ANSI terminal codes but left fully readable to any tool that captures raw output.
|
By Brian Clark
On June 1, 2026, researchers identified malicious code embedded in at least 32 package releases published under the @redhat-cloud-services npm namespace, a set of frontend components and API clients that power the Red Hat Hybrid Cloud Console. The compromised releases carry a preinstall script that runs an obfuscated payload the moment a package is installed, harvesting developer and cloud credentials and attempting to spread itself to other packages the victim can publish.
|
By Snyk Team
Champion / Spokesperson(s): Brendan Putek, Director of DevOps, and Esaie Batoula, Security Engineer. Relay Network is the innovator behind a secure B2C communications platform that combines SMS with dynamic feed technology to help regulated enterprises deliver personalized, action-oriented mobile experiences for every customer. In an industry where trust, compliance, and data protection are paramount, security has always been central to how the company builds software.
|
By Ryan McMorrow
Snyk is now detecting six vulnerabilities for every one remediated. NIST reported a 33% increase in CVE submissions in Q1 2026. According to Gartner, the average time to patch a high/critical vulnerability is 55 days (Gartner, "How to Respond to the 2026-2027 Threat Landscape," 28 May 2026).
|
By Snyk
We put Anthropic’s new Claude Opus 4.8 to the test using our standard benchmark: building a secure, production-ready Notes app. Anthropic claims this model is four times less likely to let security flaws slip through. Operating on "Ultra Code" mode, the AI navigates environment blocks, writes its own E2E security test suite, and runs dependency audits. We walkthrough the final app and run a security scan using the Snyk CLI to see if Claude's code is truly safe to deploy.
|
By Snyk
235,000 installs per week. That’s how quickly developers are downloading AI agent skills — packages that give AI coding agents new capabilities like shell access, file system operations, cloud access, and deployment permissions. But unlike traditional npm packages, agent skills introduce a completely new security problem: natural language instructions that AI agents can interpret and execute autonomously.
|
By Snyk
On May 11, 2026, the TanStack namespace was hit by a "Mini Shai-Hulud" supply chain attack. Unlike typical attacks, this did not involve stolen credentials; instead, the threat group TeamPCP hijacked the legitimate GitHub Actions release pipeline. This video covers the technical details of the OIDC token extraction, the "Dead Man's Switch" that triggers a rm -rf / upon credential revocation, and the mandatory remediation order you must follow to save your data. We also discuss how to harden your workflow using release-age cooldowns and OIDC pinning.
|
By Snyk
Are you confused by the terminology surrounding AI coding tools? You aren't alone. In this video, we break down the four essential components that transform a basic LLM into a powerful coding agent: Rules, Skills, Hooks, and the Model Context Protocol (MCP).
|
By Snyk
GPT-5.5 vs Claude Opus 4.7 - two flagship AI models dropped one week apart, and both claim to be the best at agentic coding. We put that to the test by giving each model the exact same prompt: build a production-ready, secure note-taking application from scratch. But we didn't stop at reviewing the code. We actually tried to break it by running real security tests against each app to see whether AI-generated code can be trusted with user data. The results were not what we expected.
|
By Snyk
Cursor just dropped Composer 2.0, claiming it rivals (and even beats) the industry’s leading frontier models like GPT-5.4 and Claude Opus 4.6. But do the benchmarks match reality?
|
By Snyk
In this video, we explore the growing security risk of prompt injection in large language model (LLM) applications. As AI becomes embedded in more products, new vulnerabilities emerge, especially through natural language manipulation. We break down how LLMs work, the importance of system prompts, and demonstrate five real-world prompt injection techniques used to extract sensitive information or bypass safeguards. You’ll see live examples using different models and learn why newer models are more resilient, but still not immune.
|
By Snyk
We pit GitHub Spark (in public preview) against Replit's AI agent. The challenge? Build a fully functional community forum for DIY tips from a single prompt. We compare design aesthetics, mobile responsiveness, login security, and deployment speed to see which tool creates a truly production-ready application. Which one do you think deserved the win? Let me know in the comments!
|
By Snyk
In the second match of our Vibe Coding Challenge series, we put two powerhouse AI platforms to the ultimate test: Vercel’s v0 and Base 44. We gave both platforms the exact same prompt: build a DIY Home Repair community forum.
|
By Snyk
Which AI tool is better for building a real app without writing code, Bolt or Lovable? In this video, I put both AI app builders head-to-head using the exact same prompt to create a DIY home repair forum. From database setup to authentication, UI design, publishing, and security checks, we compare how each platform performs in real time. The goal isn’t just to generate something that looks like an app, it’s to see whether these tools can actually create something usable, functional, and potentially production-ready. We evaluate.
|
By Snyk
This book will help both development and application security architects and practitioners address the risk of vulnerable open source libraries and discuss why such vulnerable dependencies are the most likely to be exploited by attackers.
|
By Snyk
Forrester conducted a customer study to get insights into why organizations choose Snyk to help them tackle and implement developer-first security. Read the report to dive into the benefits, cost and value ROI for Snyk.
|
By Snyk
This book reviews how the serverless paradigm affects the security of an application, and dives into the benefits it brings.
|
By Snyk
Snyk's annual State of Open Source Security Report 2020 is here. Download it now to learn how Open Source security is evolving.
|
By Snyk
81% of security and development professionals believe developers are responsible for open source security - but many organizations are still unsure how to start building a culture and practice of DevSecOps. Puppet & Snyk's study is digging deeper into the trends of DevSecOps adoption.
|
By Snyk
"Shift left" has become the holy grail for security teams today but organizations are still struggling to successfully implement some of the key processes that shifting security left entails. A new study sponsored by Snyk and conducted by Enterprise Strategy Group (ESG) has found that while developers are indeed being given more responsibility for testing their applications for security issues, they simply don't have the knowledge or right set of tools to do so.
|
By Snyk
The 2020 Gartner Market Guide for SCA is here! Recent Gartner survey finds that over 90% of organizations leverage OSS in application development - and as a result, security of open source packages was the highest ranked concern for respondents. These concerns have led to a growing market, addressed by various vendors for SCA tools that mitigate the risk of OSS. New trends emerge with devops on the rise - as the market shifts towards developer-friendly SCA tools.
- June 2026 (9)
- May 2026 (15)
- April 2026 (13)
- March 2026 (13)
- February 2026 (25)
- January 2026 (14)
- December 2025 (15)
- November 2025 (16)
- October 2025 (20)
- September 2025 (19)
- August 2025 (35)
- July 2025 (20)
- June 2025 (30)
- May 2025 (16)
- April 2025 (24)
- March 2025 (34)
- February 2025 (28)
- January 2025 (25)
- December 2024 (32)
- November 2024 (19)
- October 2024 (37)
- September 2024 (32)
- August 2024 (34)
- July 2024 (32)
- June 2024 (34)
- May 2024 (35)
- April 2024 (29)
- March 2024 (11)
- February 2024 (13)
- January 2024 (21)
- December 2023 (20)
- November 2023 (31)
- October 2023 (29)
- September 2023 (13)
- August 2023 (25)
- July 2023 (17)
- June 2023 (31)
- May 2023 (23)
- April 2023 (20)
- March 2023 (24)
- February 2023 (21)
- January 2023 (18)
- December 2022 (22)
- November 2022 (33)
- October 2022 (40)
- September 2022 (36)
- August 2022 (36)
- July 2022 (18)
- June 2022 (22)
- May 2022 (25)
- April 2022 (31)
- March 2022 (43)
- February 2022 (30)
- January 2022 (28)
- December 2021 (44)
- November 2021 (27)
- October 2021 (26)
- September 2021 (27)
- August 2021 (20)
- July 2021 (19)
- June 2021 (23)
- May 2021 (29)
- April 2021 (22)
- March 2021 (33)
- February 2021 (12)
- January 2021 (13)
- December 2020 (2)
Snyk is an open source security platform designed to help software-driven businesses enhance developer security. Snyk's dependency scanner makes it the only solution that seamlessly and proactively finds, prioritizes and fixes vulnerabilities and license violations in open source dependencies and container images.
Security Across the Cloud Native Application Stack:
- Open Source Security: Automatically find, prioritize and fix vulnerabilities in your open source dependencies throughout your development process.
- Code Security: Find and fix vulnerabilities in your application code in real-time during the development process.
- Container Security Find and automatically fix vulnerabilities in your containers at every point in the container lifecycle.
- Infrastructure as Code Security Find and fix Kubernetes and Terraform infrastructure as code issues while in development.
Develop Fast. Stay Secure.